A report by the United Kingdom’s National Health Service is warning of threats leveraging Log4Shell vulnerability in VMware Horizon servers by an unknown cyber actor. The NHS said the attacks are designed to establish persistence with affective networks, likely as part of a reconnaissance phase. In doing so, the attackers use the Java Naming and Directory Interface via Log4Shell payloads to call back to malicious infrastructure. Once weaknesses are identified, the attack uses the Lightweight Directory Access Protocol to retrieve and execute a malicious Java class file that injects a web shell into the VM Blast Secure Gateway service.

Related News Articles

Headline
The Cybersecurity and Infrastructure Security Agency yesterday directed federal agencies to take emergency action to prevent cyber actors from exploiting…
Headline
Cybersecurity authorities in the United Kingdom, Australia, Canada, New Zealand and the United States today urged companies that deliver, operate or manage…
Headline
The Cybersecurity and Infrastructure Security Agency and FBI yesterday updated their February advisory on destructive malware targeting organizations in…
Headline
Cybersecurity authorities in the United States, Australia, Canada, New Zealand and United Kingdom today advised organizations to apply timely patches and…
Headline
Learn why hospital and health system leaders such as Darren Lacey, chief information security officer at Johns Hopkins University/Johns Hopkins Medicine, look…
Headline
The FBI this week released a report detailing indicators of compromise associated with ransomware variants that have compromised at least 60 entities…